Customer Personal Data means personal data/information processed by Beetl on the customer's behalf through the service. Applicable Data Protection Law means the laws applying to that processing, including POPIA, EU GDPR, UK GDPR and applicable US state privacy laws. Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data. Business terms define other capitalised words.

The customer is controller/responsible party and Beetl processor/operator for Customer Personal Data. If the customer acts as processor, it confirms controller authority to appoint Beetl as subprocessor and passes down lawful instructions. Each party remains responsible for its actual role; labels do not override conduct or law. Beetl acts separately as controller only for the account, billing, security and administrative purposes identified in the Privacy Notice, not to repurpose customer content.

Beetl processes only for the service, on documented instructions comprising the Agreement, configured authorised use and additional agreed lawful instructions. Processing scope, duration, subjects and data are in the processing schedule. Instructions to transfer data are subject to section 7. Beetl promptly informs the customer if an instruction appears unlawful and may pause the affected processing while resolved. If law requires other processing, Beetl informs the customer before processing unless legally prohibited. It does not use Customer Personal Data for its own advertising, sale or general-purpose model training.

The customer determines lawful bases, gives source/employee/reader notices, respects rights, selects proportionate data and retention, and obtains necessary permissions. Beetl provides reasonable information to support these duties and remains responsible for its own obligations. Disallowed sensitive data is described in the Service Policies; inadvertent receipt triggers secure review, not unrestricted further processing.

Beetl limits access to authorised persons who need it for the contracted purposes, are bound to confidentiality and receive appropriate instructions. Access is revoked when no longer needed. Beetl implements and maintains appropriate technical and organisational measures described in the approved security schedule, taking account of risk, data and the state of the art. It regularly evaluates safeguards, remediates deficiencies and does not materially reduce agreed overall protection during the term.

The schedule separates implemented application controls from production controls awaiting verification. No assurance certification, penetration test, backup recovery objective, MFA coverage or hosting location is promised solely by reference to an unverified template. Before personal data enters production, the parties complete and approve that schedule. Beetl provides evidence of implemented measures on reasonable request under section 6.

The customer gives general written authorisation only for the named, approved subprocessors and purposes in the executed provider schedule. Beetl remains responsible to the customer for their performance of the subcontracted data-protection obligations. It imposes written protections no less protective for the relevant processing, undertakes proportionate diligence, and limits data and access to the approved purpose.

Proposed change procedure: Beetl gives at least 30 days' advance notice by email to the customer's nominated administrator before adding or replacing a subprocessor, identifying processing, countries and safeguards. The customer may object on reasonable data-protection grounds within that period. The parties seek a reasonable alternative. If none exists, the customer may terminate the affected service before the change with refund of unused prepaid fees. Beetl must not transfer the affected data to that provider while the objection remains unresolved. Urgent replacement necessary to protect data receives as much prior notice as practicable and prompt written details; it does not bypass mandatory authorisation or transfer requirements. Notices and objections must be operationally supported before use.

A customer-selected external connector or learning destination may be an independent recipient appointed by the customer, rather than Beetl's subprocessor. The executed schedule states the actual role; customer selection does not exempt a Beetl-appointed vendor from this clause.

Beetl promptly forwards requests concerning Customer Personal Data to the customer and does not independently disclose, erase or otherwise respond on the customer's behalf unless instructed or required by law. It assists with access, correction, deletion, restriction, objection and portability using available tools and proportionate manual action, preserving tenant isolation and requester verification.

Proposed service target: acknowledge customer assistance requests within two business days and provide available information within five business days, or earlier where necessary for a notified legal deadline. It promptly explains any obstacle and agrees a lawful response plan. The target does not extend statutory deadlines or authorise refusal solely because a tool lacks automation.

Beetl assists with impact assessments, prior consultations, records and regulator enquiries relating to its processing, considering available information. Ordinary assistance and work caused by Beetl's breach are included in service fees. Exceptional customer-specific work may be charged only at a rate agreed in advance; no fee delays necessary incident assistance or mandatory rights. Each party manages its own regulator obligations.

Beetl notifies the customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. Proposed operational ceiling: initial notice within 24 hours of awareness, without waiting for a complete investigation. Where POPIA applies, Beetl notifies immediately when reasonable grounds exist to believe personal information has been accessed or acquired by an unauthorised person. The earlier or stricter applicable trigger prevails; 24 hours is not permission to delay an immediate notice. Unsuccessful generic scans without compromise are not alone Security Incidents.

Notice goes to the agreed incident email and escalation channel. Initial notice states known nature/time, affected systems/data/subjects, likely consequences, containment and the contact, clearly distinguishing unknown facts. Beetl provides material updates and, as a proposed target, at least daily updates during active containment unless otherwise agreed. It preserves relevant evidence securely, mitigates harm, cooperates with the customer's assessment/notifications and supplies a written closure summary. Neither party must speculate or disclose another tenant's data.

The customer ordinarily determines notices to individuals and authorities for its controller processing. Beetl does not notify in its name without authority unless law requires; Beetl's own controller/legal reporting remains unaffected. Beetl promptly informs the customer of legally binding disclosure requests unless prohibited, examines validity and challenges disproportionate requests where reasonably justified, discloses only what is required and records its response. Applicable mandatory transfer clauses control additional government-access obligations.

Beetl makes available information reasonably necessary to demonstrate compliance, including relevant policies, security evidence, subprocessor information and remediation status. The customer and a confidential independent auditor may conduct proportionate audits, including inspections, subject to reasonable security controls protecting other tenants and secrets. Proposed ordinary cadence is once annually on 15 business days' notice; incidents, reasonable evidence of non-compliance, authority requests and mandatory transfer terms may justify additional or urgent audits. There is no absolute annual restriction or compulsory reliance on an unavailable certification.

Document review and remote evidence precede site access where sufficient, but do not prevent an inspection legally necessary to demonstrate compliance. Parties agree scope, safety and scheduling without undue delay. Each pays its ordinary costs; Beetl bears reasonable additional audit costs for a substantiated material breach it caused. Beetl promptly supplies a remediation plan and evidence of correction. No general commercial cap restricts authority powers or mandatory individual rights.

Beetl processes in, or permits access from, only the countries in the approved schedule and under documented instructions and lawful safeguards. A European hosting region alone does not resolve operator access from South Africa or onward vendor transfers. No party assumes South African adequacy, a vendor's certification coverage, zero retention or regional AI processing without current evidence.

For EEA restricted transfers, the parties complete and execute the applicable, unmodified official EU Standard Contractual Clauses (SCCs), with the correct module and annexes and documented transfer assessment/supplementary safeguards, unless another valid mechanism is evidenced. For UK restricted transfers, they execute an applicable official UK Addendum to those SCCs or the IDTA and the required assessment. The transfer worksheet identifies the importer/exporter, role, locations, choice provisions and annex data. This draft does not incorporate an unspecified module or pretend blank annexes are executed. No affected production transfer starts until the required instrument is complete.

The parties cooperate on lawful transfer assessments and supplementary safeguards and suspend affected transfers if required protections cannot be maintained. Mandatory transfer instruments prevail over conflicting Agreement provisions, including governing law, jurisdiction, audit and liability restrictions. No commercial variation modifies their mandatory text.

This DPA continues while Beetl processes Customer Personal Data. On termination or instruction, at the customer's choice, Beetl returns the data in an agreed accessible format and deletes remaining copies, or deletes it without return, unless law requires retention. The proposed offboarding/export window is 30 days after termination; urgent lawful deletion requests are handled sooner where required. Export scope must include available files and learning/evidence records, with coverage verified before commitment.

Confirmed organisation deletion currently has a default 30-day cooling-off and a separate private-object cleanup workflow. The signed schedule must specify active-data purge, retry/escalation and backup expiry deadlines before launch. Proposed contractual ceilings are active deletion within 30 days after confirmation (including any agreed cooling-off) and backup expiry within 90 days after active deletion, conditional on operational verification and approval; these are not assertions about current infrastructure. The cooling-off must be shortened or bypassed through an authorised procedure when law requires faster erasure.

During restricted backup retention, no ordinary access or new use is permitted. If recovery restores deleted records, Beetl reapplies the deletion before returning the restored system to service. Where law requires retention, Beetl identifies the basis, scope and duration where lawful, isolates the retained data and uses it only for that duty. Beetl supplies written deletion completion and any limited exceptions on request. An expiring download link or deleted database row alone is not proof that files/backups were erased. No unsupported legal-hold automation is claimed.

For POPIA-regulated processing, references to controller and processor include responsible party and operator, and personal information includes covered information about identifiable existing juristic persons. Beetl processes with the customer's knowledge/authorisation, preserves confidentiality and maintains risk identification, safeguards, verification and improvement appropriate to section 19. Section 5's immediate compromise notice applies. Sub-operators are bound to corresponding duties. Before a section 72 transfer, the parties document the applicable lawful ground and enforceable protection; other countries' transfer documents are not automatically a South African compliance finding. Customer and Beetl retain their own applicable Information Officer, PAIA and privacy-governance duties.

Beetl provides the agreed processor assistance, confidentiality, security, deletion and audit obligations for processing subject to the respective GDPR. It informs the customer immediately if, in its opinion, an instruction infringes applicable data-protection law. Where Beetl or the customer is directly in scope as controller, each independently assesses required representatives, supervisory authority, DPO and impact assessments; designation of a processor does not discharge those duties. UK references include applicable amendments and commencement provisions. The Privacy Notice and executed schedules must reflect the actual arrangement, including workforce processing requirements.

To the extent applicable US state law treats Beetl as a processor, service provider or contractor, it processes personal information only for the specifically described business purposes in the schedule and documented instructions. It does not sell or share it for cross-context behavioural advertising, retain/use/disclose it outside those purposes or the direct business relationship, or combine it with data from other customers or its own interactions except as permitted by applicable law. It does not assert that all statutory exceptions are authorised by this clause.

Beetl provides the same level of privacy protection required by applicable law, certifies understanding and compliance with these restrictions where contractor certification is required, and promptly notifies the customer if it can no longer comply. The customer may take reasonable and appropriate steps to verify consistent use and stop/remediate unauthorised use, including section 6 audits. Beetl assists with consumer rights, assessments and legally required assurances and binds onward recipients to applicable restrictions. It does not evade duties by describing personal data as anonymous: deidentified data is subject to reasonable anti-reidentification measures, a commitment not to reidentify except lawful testing, and corresponding recipient restrictions. No use of customer data for unrelated analytics is authorised.

The parties assess actual statutory coverage and exemptions per state and data context, including workforce/business-contact information. This DPA does not promise compliance with every sector law or constitute a HIPAA business associate agreement. Regulated health, financial, educational, biometric and children's processing requires a separate approved arrangement before use.

The DPA is signed or expressly incorporated by both authorised parties with its completed schedules, versions and any mandatory transfer instruments. General contract liability applies only as lawful between the parties; it does not limit mandatory transfer rights, data-subject remedies or authority powers. The review register is internal and not part of an executed customer agreement. Resolve every factual field and approval condition before execution.